Have you try to use Deployment Image Servicing and Management (DISM) ?
You can use dism directly :
dism /online /get-packages
/online don't means that you need internet but only that the target the current system.
My question is how to maintain local Active Directory for computer
accounts and logons and keep passwords in sync with Office 365?
If you're already using Azure AD Connect then you don't need to do anything, you're already doing it. Keep using Azure AD Connect like you are now. If you're using password hash sync then the password hash for each user ...
Check that service is running and listening on all IPs, or its new IP. Packet capture the application's port on both ends of the conversation. traceroute / tracepath to identify paths. The usual.
Examine all routers and firewalls between the two until you narrow it down. Provide evidence you have done your homework from the host perspective and want to ...